0ca8cc96bffe4606a05e85b1ac9f66e4fe061bea4fd06587e04f5b0c83b6b027

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83097940198pwd=Zxa7bbEtlbuIgquGluyd/admin_sidebar.html
Size 4KB
Sample260705-aj61lsfs91
SHA256 0ca8cc96bffe4606a05e85b1ac9f66e4fe061bea4fd06587e04f5b0c83b6b027
MD5 e5d90f1916059efd180cf95f787cd89b
SHA1 36b68c0c104dcaef3c8399855955b869d3fdb2f8
SHA512 c2d12fe1f041d09540a1c7b6bf06b1f64f1268852630a63a325d5d1ccdef19cb4eb73e290aed3177d02c6e8af150198d8aeace30076a2000e05407dce07549c8
SSDEEP 96:ARiT0F6Iznzlgg6c6mxYzsMr5Y6r7ZdOL/HhrIqhLKw:+qMznzWxc6mxYVr5Y63c2iLKw
TLSH
T1A5A1976A26D018394273822542E2B774FC3C84D7DB079229793C918F1FF1B48C857EDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276841609090585"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2040E688-9134-44CA-9CED-EFBF5173E105}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4408	4772	msedge.exe	83
PID 4772 wrote to memory of 732	4772	msedge.exe	85
PID 4772 wrote to memory of 3160	4772	msedge.exe	84
PID 4772 wrote to memory of 3160	4772	msedge.exe	84
PID 4772 wrote to memory of 3160	4772	msedge.exe	84
PID 4772 wrote to memory of 3368	4772	msedge.exe	86
PID 4772 wrote to memory of 3368	4772	msedge.exe	86
PID 4772 wrote to memory of 2812	4772	msedge.exe	88
PID 4772 wrote to memory of 2812	4772	msedge.exe	88
PID 4772 wrote to memory of 2812	4772	msedge.exe	88
PID 4772 wrote to memory of 2056	4772	msedge.exe	89
PID 4772 wrote to memory of 2056	4772	msedge.exe	89
PID 4772 wrote to memory of 2056	4772	msedge.exe	89
PID 4772 wrote to memory of 4312	4772	msedge.exe	90
PID 4772 wrote to memory of 4312	4772	msedge.exe	90
PID 4772 wrote to memory of 4312	4772	msedge.exe	90
PID 4772 wrote to memory of 1924	4772	msedge.exe	91
PID 4772 wrote to memory of 1924	4772	msedge.exe	91
PID 4772 wrote to memory of 1924	4772	msedge.exe	91
PID 4772 wrote to memory of 400	4772	msedge.exe	95
PID 4772 wrote to memory of 400	4772	msedge.exe	95
PID 4772 wrote to memory of 2828	4772	msedge.exe	96
PID 4772 wrote to memory of 2828	4772	msedge.exe	96
PID 4772 wrote to memory of 4412	4772	msedge.exe	98
PID 4772 wrote to memory of 976	4772	msedge.exe	113
PID 4772 wrote to memory of 4008	4772	msedge.exe	114
PID 4772 wrote to memory of 3392	4772	msedge.exe	115
PID 4772 wrote to memory of 804	4772	msedge.exe	118
PID 4772 wrote to memory of 804	4772	msedge.exe	118
PID 4772 wrote to memory of 400	4772	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\83097940198pwd=Zxa7bbEtlbuIgquGluyd\admin_sidebar.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,1118418659281136867,15498100086537598062,262144 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,7982595839396647632,4013100858075374094,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,8904935572029008640,7526965977470747050,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11467083490777998737,10162849811722468421,2097152 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,3538648200803505482,2096151646396665833,2097152 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,6822064242397605355,4655350847146484132,2097152 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,1962713481097986996,17721650547329864320,2097152 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9597372818543063194,15310841839808521682,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,178023745336969015,12720716222206556041,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5758318527588115521,14200005835115769609,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5758318527588115521,14200005835115769609,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,6868074783447877211,6314752652692026374,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,5549107514463200061,3916746127264882836,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,103788783575407414,8809074025346754288,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,5467638721921990492,8695464733029493079,524288 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6076,i,2242936290653119062,15761650942478114744,262144 --field-trial-handle=2256,i,8551456320662777845,3652058753400621520,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 901b81c1ccb55908808b13319a94c549db3b2593e5a958858a1358a80c649ef4
MD5 d0815c92b0dfc49805120158b43a87a6
SHA1 c7d20366ce7c3d68464f74f3143b3168f3e8c22d
SHA512 3c5b3ba521e6e16bd141aa7b9c04731acd197e9e137cd048418b509b64666e53e4d3149f1e9d2073df70ad4c02e365c9dc7cd5ef69c2a74750786f9f5696e202
TLSH
T1CD61D7380A12B89DF7311373F6D03BFD37F251A94D5B5ED951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a97a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a97a.TMP
Size 3KB
SHA256 d6dacbb25c551d3360d4d3e725b68f0a508740dcc351d319b0ceda4fbcc706a0
MD5 23d7d7b61dac88683c74aa5c321a968c
SHA1 a3aabb6d53658094b0636c89b16af7732900c84b
SHA512 866b29e3e65ad97928d7de207de91227794ca834e5a7c7c770cb0efcdb915918bc59711475412744fc240e9cd600f640df10d0959232c1a4426ff7aec2333931
TLSH
T1F461D7380A12B89DF73113B3F6E03BFD37F251A94D5B5EDA51A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7503c39b92060e01fec04286edb11ee2bbe54326f3b60c779e1bac8bd56f370b
MD5 802743a9be665c10c9add8c8a9bf3ff1
SHA1 62038a05bb9c9c3ec3ce47ed1a154c3e49ec3ab7
SHA512 a00385a05bc1505ace76497a30828b06a0d5ad9629d0669dc99919590881007078e85784bfa0b465dda3f5d10024f8b5b3169f553ec2a17a62112cc6be06d690
TLSH
T11F117DB3C3D5856E8A0157F06B24AE2BCE2D0A05431C7D1985D4EF57D3E347AE00159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b65bd9f5a9a0c9cbc07dc2196c35b09b7108b754b6e184ab4fc0d2b193737f7
MD5 f1aa09ca4880d1ee23bf68985b0e57a1
SHA1 fc78b3dafd27239d60bacc5b358a8635656f00d5
SHA512 ecd0688e08f54914fba7300dd7030bb0f02c47aaeb9d387bbd74d758ee66e64f96182d1ef25b5829eef271b814da9dd048cbe38de882fc52c0e70681d15e7e20
SSDEEP 192:sxZoR9yM/jK1Ml8Mka/fesOBmCIdpdtHW6+WNGYLz9V+GIgrJ:sxZonMa/fesOIrzHbGwd9
TLSH
T15342F8126A345977CCDBD209FA55BF53D6F90473A2940E44AAFCCA0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 909642e4db4ceb3ce59aea1e42be751e01cd6002b4ecdf4b2ece6304a13725c6
MD5 d1c0ae8891aa2bc2cdb9a43626e60769
SHA1 f57675c4d30fda405a280150c0f3488b65f5da5a
SHA512 b8b09ba28c947a6c601f3e68407aa7c187c2056e1a2d3696f2b07ef32ac7d0bd26b8a04d6529e7180804b96a27013142ec103d51b946101917d3767e0c282552
SSDEEP 192:sxZoR9yM/jK1Ml8UQ2ka/feslBACIdpHtHW6+WNGYL/kX+GIg5BJ:sxZonqda/feslqrNHbGTd5
TLSH
T13152E7126A345977CCDBD209FA55BF53E6F50473A2940E44AAFCCA0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d5cc4fe57a6eaf676c48d423a25512ee8c41b91348f19e6d2b71671d3c135d5e
MD5 226bd95cc6572150eabca89b2c78b04c
SHA1 c1e70fbfe22f267d138d2db8ee4dfdf968e52c2b
SHA512 00167f5d063d86ccf05f6e444802954c80ed7a613eaf559d67a87e70adfd6902c72d71021a8e58684530ef497ea164b8162edda0f12cd508905b633646cf3f4d
SSDEEP 768:oms6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNHrozF:oms6pD1WvxzWju1jahILIsNUzF
TLSH
T15ED2EA3B680CCB7E4F841E5CEC2A6F967DD801CBAB98895447FA844C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a806d90b908cb807dc91bb92b06f5a2a4eba37c198064feba2de02dc7f3be73a
MD5 ee7470b70e8a86b1de18f317bb99734a
SHA1 d4b44686e5b7545a714c88b56fdc73d2e9ecdcde
SHA512 a45692cb0802e19c0a65cba685216d1460cbbe0a8be29dd5f99b0b95f1c6dd6074326df75fc3fd614a86a08585bb0d55383f65eea6349952ddffa66dbef67f74
SSDEEP 96:KUAAKtePJHohV/lR7whKKm97KeCmb7KHPCpxIJLsd5kNSKOsC9GXqW4UIg0MpzuD:iiJHohV/lR8hK19XCmbuHPCpxIJLsd51
TLSH
T13EC1E01335BB47123C3E290CA25497265B82F7A73018E92B37A810B54E67E794DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59455c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59455c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 64e9523c4048fc51aef9c7bfc089999facd0ac361c8587086d24fcf4c35a249f
MD5 6ec9a5664054d7077fd8f84a8058e9ed
SHA1 b022ea1b6ae78c0d6fbb318dcb495f83c0108a3a
SHA512 d3d337f3899a39619e47ea0cfe3026f695b606358bb69817662f1cb288ce853a018cc5cc6478f9324eeba7f7e6d9cac40a609e80cca3d0de3cd49ad62769ac7b
SSDEEP 384:KiF1tNn/s3n9SUzsNb8TUNTUlIlpwE+P0bdua9nODaw/JOObjI9G6w7w1:BF1j+9Xuwg0kbhdO2w/J29MS
TLSH
T133A27C335C988D779DA28A89FA4A3617DFF500B7D6862E80E6DD9F0C01EB5EC0346D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d09423585927c224339cbd6f33e461417dc19c11e2c255a9c1dc46239678682c
MD5 cdac3a5dcdc6cba9f8dea075ec306497
SHA1 d42af068c6becc6cfe8aa41cde60c812181d20f5
SHA512 a4c0bfe067836a90df06adbbdf06d263f27400769391407953814b11bf93714ecb01f6bc65315cecfbaaf7f8f851a2ac3afc13688c4b6ffade1a3653282525d4
SSDEEP 192:qONp6O7+3hQmiUyoUGttb0mO2opgG5fU6:qONp61cGt9nOD5FU6
TLSH
T1BB02F8356C7C6CB78EB2AE45FA8737179FA5103BE9962F80D6E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f3d61e31ab27ca96d70da33c04d54c3c2879da2f74f43768a2f164f987cc583a
MD5 a4650fec10aad8d77208195f1b01bfb6
SHA1 28bcd1c722ce1704b68fe54be0617453e454431e
SHA512 529f9257c4eabf706e417905852155915c01f791a967f71b942a0c8a3c461108d7d1f29973fdc4ede12498bc43af3d57dce1dc1ffd7bedeab0df7426cc90eaca
SSDEEP 384:LtNn/s3n9SfsNWUpwE+P0bdua9nODawIJOObjI9G6w7w1:Lj+9UbkbhdO2wIJ29MS
TLSH
T11392AF326C684C734DA39589FA4B3617DFF44077A6CB2E84D5EDAF0C02EB6AC1346916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5bbcfe7b13e79554ce5d3bbc62385304ffc079a8e59da5f407ca20a37f49bbfb
MD5 2c08a91cd172a6f9bf7382b72ecf0d34
SHA1 7fb349f236e9233b33c3c1665c18cb4de6e52066
SHA512 939006dccd0b0fefa892c715889ad3bb9617c62f421cd0d6f73f2fe9e7d80f3ece0fd711ec68dcdc5b5a815aa62b4acced80c02ab2445b5dfd9f3a0f87e214ac
SSDEEP 192:sONU6O7+3YQmiUyBUkttb0mO2oazECcNQqOMU6:sONU6G5kt9nODaw7JU6
TLSH
T11112FA36687C9C775DA2A585F98736139F650167EA8A3F80D5DC2E0C01EF6AC238B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 df54b3aa33f1b3a6121d42dc49b1e12986ba907fa24bdaedac52f6d5aec37f5f
MD5 3998ac645c7bcc91c80e25e063eb2ce5
SHA1 89c32152a2b7dbbacc4b6007b9f9afee7191cec5
SHA512 2e63e24718b5df0d93c533fd3b4af084563bc6a225133b169ba868138c9fd79314466c78bcd4c8e985576d2c79c8efc3cf2a4483fb726111e72a8f420423d36e
SSDEEP 384:GtNn/s3n9SfsNWUgwE+P0bdua9nODawIJOObjI9G6w7w1:Gj+9USkbhdO2wIJ29MS
TLSH
T1B592AE326C784C734DA28589FA8B36179FF44077E6C62E84D5EDAF0C02EB6AC1346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f3dff7e-7ca9-4a6c-8f7c-4a38babb76b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f3dff7e-7ca9-4a6c-8f7c-4a38babb76b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 157580965350a6448ab966242475357462136db272ca9dc3317a86fc75935500
MD5 c9a7c9fd0663aba9b182700d89da74c9
SHA1 dde976b51b2944317f00814c3652c4e95e7588bb
SHA512 eb15f4072958b0ed8968dd4023d17ec2124c2333345e66ac572c3423fb8378b966f9c7a4fac7bcb8eb87e50cffda5fb15d2ac2bdd81cae0b7390397ffa938640
TLSH
T15741485CB6F91148B3B7AF1A9BF2A92D847B7C732E07D46E00010E4F0A22A44D871B37
MD5 SHA1 SHA512 TLSH

Submit Download